Subject: IPsec and Remote Access related drafts

From: "Stephane Beaulieu" <[email-masked]>
Date: Thu, 19 Oct 2000 09:05:26 -0400

Sorry for the cross postings.  This may be of interest to people on both
mailing lists.

The Mode-Cfg draft and XAUTH draft have been resubmitted as personal
submissions.  New mailing lists have been set up, so that those interested
can post constructive comments.  You can subscribe to the lists by sending
an email to:

[email-masked] (for mode-cfg)
and
[email-masked] (for XAUTH)

and having the work "subscribe" in the body.

The lists will not be accepting posts for the next couple of days to give a
chance to people to sign up.

The drafts can be found at:
http://www.ietf.org/internet-drafts/draft-dukes-ike-mode-cfg-00.txt
http://www.ietf.org/internet-drafts/draft-beaulieu-ike-xauth-00.txt

Thanks,
Stephane.

------
Stephane Beaulieu
S/W Engineer
VSEC Business Unit, Enterprise Line of Business
Cisco Systems.
email: [email-masked]
phone: (613) 271-3678

---

From: Ben McCann <[email-masked]>
Date: Thu, 19 Oct 2000 10:15:13 -0400

Can we also include Hybrid-Auth as part of the agenda for
the XAUTH mailing list? IMHO, Hybrid plus XAUTH is much better
for legacy authentication than XAUTH by itself.

Perhaps the hybrid auth authors (M. Litvin, R. Shamir, T. Zegman
of Check Point) can also resubmit the Hybrid Auth draft as a
personal submission. I assume it expires soon if it hasn't already.

-Ben McCann

-- 
Ben McCann                              Indus River Networks
                                        31 Nagog Park
                                        Acton, MA, 01720
email: [email-masked]           web: www.indusriver.com 
phone: (978) 266-8140                   fax: (978) 266-8111

---

From: Ari Huttunen <[email-masked]>
Date: Fri, 20 Oct 2000 13:52:52 +0300

I don't see any particular reason to discuss Hybrid. If the endpoints
already have machine certs, X-Auth is appropriate. If the client does
not yet have any kind of a cert, some method to-be-defined by IPSRA is 
appropriate.

Is VPNC also going to host the mailing list archives for those
new lists?

Ari

-- 
Ari Huttunen                   phone: +358 9 859 900
Senior Software Engineer       fax  : +358 9 8599 0452

F-Secure Corporation       http://www.F-Secure.com 

F-Secure products: Integrated Solutions for Enterprise Security

---

From: Ben McCann <[email-masked]>
Date: Fri, 20 Oct 2000 07:42:09 -0400

> not yet have any kind of a cert, some method to-be-defined by IPSRA is 

Perhaps you're right. I can always use Hybrid Auth between endpoints
when I control both peers. That provides me a solution that we can sell
until IPSRA defines, and we implement, another solution for clients
that don't yet have certificates. We will implement IPSRA's protocols
for interoperability; we just can't wait until such time as those
protocols are well defined.

-Ben McCann

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Fri, 20 Oct 2000 09:22:35 -0700

At 1:52 PM +0300 10/20/00, Ari Huttunen wrote:
>I don't see any particular reason to discuss Hybrid.

Actually, there is no need to discuss any of these on this mailing 
list. XAUTH and mode-cfg and Hybrid are *not* part of the IPSRA WG 
charter (or part of the IPsec WG charter). That's why the separate 
mailing lists were formed.

Please move this discussion to the new mailing lists (which will 
start up on Monday, but you can subscribe now).

--Paul Hoffman, Director
--VPN Consortium

---

From: Ari Huttunen <[email-masked]>
Date: Sun, 22 Oct 2000 03:11:27 +0300

> mailing lists were formed.

X-Auth will remain in our implementation at least until this WG
succeeds in producing something to the following problem:
- Client has a machine certificate
- User authentication is done via a legacy method

It is not sufficient to just leave the machine certificate be unused.

Is it the intention of this WG to produce something for this or not?

> start up on Monday, but you can subscribe now).

Sure.. And if someone wants to discuss Hybrid, why don't you set
up another list for it too.. ;)

Ari